Splunk Search

How to combine two field extractions into 1 with regex?

kamal_jagga
Contributor

I read in the best practices that if possible, combine two field extractions in to 1. This will improve the efficiency of the system.

But when I tried implementing it, it's not giving satisfactory results for all scenarios.

eg. When the 1st field is blank or space, it's not extracting the 2nd field consistently.

Has anyone else also faced this issue?

Thanks

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey, do it like this and let me know if this is what you like:

extract-aaa = ((?<field1Name>[field1NameRegex])(?<field2Name>[field2NameRegex]))

So if this was my data:

timestamp - datafield1 and datafield2

I might use this:

extract-aaa = (?<field1>(?<=timestamp - ).*(?= and )(?<field2>.*)
0 Karma

jkat54
SplunkTrust
SplunkTrust

my regex doesnt work with my data sample by the way but i'm thinking you might get the point if you know regex well enough.

0 Karma

gcato
Contributor

The regular expression syntax can get a bit complicated when extracting multiple fields under one rex, but it does work. I suggest using a tool like regex101.com to test with your regular expressions to get it right. I find that they usually happily transfer into Splunk once you've got the syntax right.

Here's a run anywhere splunk example that extracts multiple fields using one rex. Note the nesting of fields extractions.

|stats count as foo |eval foo = " la de dah de da" |rex field=foo "^(?: *)(?P<all>(?P<first>[^\s]+) de (?P<middle>[^\s]+) de (?P<last>.+).*)$"

I suggest going to regex101 (or some other regex tool) and playing around. Here's a link to the example above: https://regex101.com/r/iU2zD0/1

Hope this helps.

0 Karma

Murali2888
Communicator

i faced the same issue when combining multiple field extractions under one rex. Though i had a work around to split them into multiple rex, I would like to understand if this is a limitation

0 Karma

ppablo
Retired

Hi @kamal_jagga

I think it'll be best if you include sample data and the regular expression(s) you've tried already for other users to best help you here.

0 Karma

kamal_jagga
Contributor

Following are my 2 Field extractions:

100_cricket : EXTRACT-runs_1     ^.{23}.{23}35.{121}(?P<runs_1>.{1})
100_cricket : EXTRACT-runs_2     ^.{23}.{23}35.{123}(?P<runs_2>.{1})

I would like to combine them to improve efficiency.

100_cricket : EXTRACT-runs_1,runs_2      ^.{23}.{23}35.{123}(?P<runs_1>.{1})?(?P<runs_2>.{1})

But this regex doesn't work if 1st field is blank or junk values.

Kindly advise.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...